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EXECUTIVE SUMMARY 


Overview 

Open records laws cannot serve their purpose if requested records no longer exist. And yet, the 
open records acts of many states, including Colorado's, do not address the retention of public records in 
a meaningful way. While other statutes may address retention, those laws generally are not enforced or 
leave a wide berth of discretion to the public employee managing the records, especially when it comes 
to emails and text messages. The result is that communications often are not retained and thus are not 
available when someone submits an otherwise valid Colorado Open Records Act request for them. 
Colorado should address this problem by adopting clearer policies and, perhaps, by purchasing or 
developing software to automate the process. 

Relevant Colorado statutes 

• The State Archives/Public Records law (Colo. Rev. Stat. § 24-80-101 et seq.) requires state 
agencies to establish and maintain a record retention schedule, and the State Archives suggests 
that agencies adopt the models it has created. However, the statute and the model schedules 
generally let employees determine which emails should be kept. 

• The Colorado Open Records Act (Colo. Rev. Stat. § 24-72-201 et seq.) was amended in 1996 to 
clarify that electronic records may be public records. It directs records custodians to adopt 
retention policies, but it does not specify how long electronic records should be maintained. 

• The Uniform Records Retention Act (Colo. Rev. Stat. § 6-17-101 et seq.) sets forth a default 
retention requirement for public records of three years. 

Alternative Approaches 

• Federal level: The National Archives directed all federal agencies in 2012 to adopt email 
management programs by 2016. Most have adopted the Capstone approach, a method of 
flagging emails for retention based on (1) whose email it is and (2) the email's content. 

• Automated retention software: The Oregon State Archives created a software program that 
automates the retention process. North Carolina is working on a similar system. 

• Legislation: States like California, Montana, and Missouri are considering or enacting legislation 
that more clearly expresses how state agencies should manage email. Under Florida law, public 
employees who do not properly maintain a record may be forced to pay a fine. 
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I. INTRODUCTION 


Open records laws cannot serve their purpose if requested records no longer exist. Both the federal 
Freedom of Information Act (FOIA) and many state open records acts provide a right of inspection only 
to existing records and do not require public officials to disclose a previously destroyed record. 1 And yet, 
the open records acts of many states, including Colorado, do not provide meaningful guidance regarding 
the retention of public records. 2 In Colorado and some other states, statutes separate from the open 
records act address records retention, but those often are not enforced or leave a wide berth of 
discretion, especially for the management of electronic communications such as emails and text 
messages. 3 

The result: Communications that are, in fact, public records often are not retained and thus are not 
available when someone submits an otherwise valid request to inspect them. Last fall, a state senator 
seeking the emails of a high-ranking employee in the Colorado Department of Public Health and 
Environment was told that the communications had been deleted soon after the employee resigned his 
job. 4 A Basalt resident who requested text messages sent between the mayor and the town clerk during 
a contentious election was told the messages had been deleted. 5 (The local district attorney investigated 
but declined to pursue charges, finding "ambiguity" in state law about the retention of records. 6 ) When 
a reporter for the Colorado Springs Independent requested certain emails sent and received by the 


1 Steve Zansberg, Cloud-Based Public Records Pose New Challenges for Access, 31 Comm. Law. 12,16 (Winter 2015). 

2 Id.; see also 3. Records Requirements, Reporters Committee for Freedom of the Press, https://www.rcfp.org/open- 
government-sections/3-records-retention-requirements/ (last visited Jan. 19, 2019). 

3 Reporters Committee for Freedom of the Press, Obtaining government officials' business emails should be easier, 
Poynter., July 31, 2015, https://www.poynter.org/reporting-editing/2015/obtaining-government-officials-business- 
emails-should-be-easier/; Zansberg, supra note 1, at 16 ("these statutes ... leave a tremendous amount of 
discretion to individual records custodians ... often the very employees who generated and exchanged the e- 
communications."). 

4 Andy Koen, Thousands of Policy Emails Sought by State Senator Were Deleted, KOAA, Feb. 24, 2019, 
https://koaa.com/news/2019/02/24/thousands-of-policy-emails-sought-by-state-senator-were-deleted/. 

5 Scott Condon, Retention of Texts Between Mayor, Clerk at Center of Basalt Battle, The Aspen Times, June 4, 2016, 
https://www.aspentimes.com/news/retention-of-texts-between-mayor-clerk-at-center-of-basalt-battle/. 

6 Scott Condon, DA: No Criminal Charges Against Basalt Mayor, Clerk In Text Case, The Aspen Times, July 29, 2016, 
https://www.aspentimes.com/news/da-no-criminal-charges-against-basalt-mayor-clerk-in-text-case/. "The 
episode in Basalt illustrates a number of the difficulties in applying public records laws to text messages: users 
think of and treat text messages as personal and ephemeral; texts can be deleted from phones and often are not 
stored elsewhere, making retention enforcement difficult; and officials charged with enforcing the laws can be 
confused regarding the applicability to texts." Helen Vera, "Regardless of Physical Form": Legal and Practical 
Considerations Regarding the Application of State Open-Records Laws to Public Business Conducted by Text 
Message, 32 Comm. Law. 24, 30 (Spring 2017). 
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former mayor of Colorado Springs, she was told the emails had been deleted and couldn't be recovered 


because they had been kept on the city's server for only 90 days. 7 

Problems with the retention of electronic public records can be categorized into three primary areas 
of concern: (1) Auto-delete functions on email accounts and apps like Snapchat and Confide; 8 (2) the 
affirmative deletion of correspondence by individuals in control of their own accounts; and (3) the use of 
private devices and accounts for government business. This report does not address the third category, 
but it is an important area of concern. 9 

The following pages will discuss the current state of Colorado law on records retention and how 
state agencies and local governments in Colorado interpret and implement it. It will then look at 
alternative approaches being used by federal agencies and other states. Finally, it will offer 
recommendations on how to improve and better enforce Colorado law on records retention and how to 
promote better practices among public employees. 

II. CURRENT STATE OF COLORADO LAW 

A. State Archives and Public Records Law (C.R.S. § 24-80-101 et seq.) 

1. The governing statute for public records management 

Article 80 of Title 24 governs the "preservation of permanent records and the destruction of records 
that are no longer of value to public agencies," 10 and it defines a "governmental agency" as any division 


7 Pam Zubeck, Ain't no sunshine: Despite laws that require transparency, city government keeps us in the dark, 
Colorado Springs Independent, July 2, 2014, https://www.csindy.com/coloradosprings/despite-laws-that-require- 
transparency-city-government-keeps-us-in-the-dark/Content?oid=2900323. 

8 See, e.g., John Kaehny, et al., Groups Applaud End of Automatic Deletion of Emails, Reinvent Albany, May 22, 

2015, https://reinventalbany.org/2015/05/groups-applaud-end-of-automatic-deletion-of-emails/; Ali Breland, 
Missouri Governor Fighting Lawsuit Over Disappearing Messages App, The Hill, Feb. 1, 2018, 
https://thehill.com/policy/technology/371879-missouri-governor-faces-lawsuit-over-disappearing-messages-app 
(Missouri's governor defended his administration's use of Confide, which automatically deletes messages after the 
recipient reads them). 

9 The majority of courts in the U.S. have held that records sent or received by a public official and discussing public 
business are public records, regardless of whether they are housed on a government-owned device or not. See 
Zansberg, supra note 1, at 14. But what methods a government can use to compel its employees to turn over the 
content of their personal devices is still up for debate in most jurisdictions. Id. "The temporary, extemporaneous 
quality of text messages presents challenges of compliance with open-records laws, particularly to retention and 
preservation requirements." Vera, supra note 7, at 30. 

10 RM FAQs, Colorado State Archives, https://www.colorado.gOv/pacific/archives/rm-faqs#laws (last visited Feb. 8, 
2019). 
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of the state; of any county, city, special district or other district; or of any other legal subdivision in 
Colorado. 11 It defines "records" as 

"... all books, papers, maps, photographs, or other documentary materials, regardless of 
physical form or characteristics, made or received by any governmental agency in 
pursuance of law or in connection with the transaction of public business and preserved 
or appropriate for preservation by the agency or its legitimate successor as evidence of 
the organization, functions, policies, decisions, procedures, operations, or other 
activities of the government or because of the value of the official governmental data 
contained therein." 

and then goes on to describe some exclusions. 12 Section 24-80-102.7 requires state agencies in 
particular to "[establish and maintain a records management program" that "satisfies the 
administrative and technical procedures for records maintenance and management established by the 
state archivist." 13 In 2016, the Colorado legislature updated the State Archives and Public Records Law, 
adding the definition of "governmental agency" and other provisions in an attempt to clarify the State 
Archives' role." 14 

2. Retention of email is discretionary 

The public records management statute leaves much discretion to the individual public employee 
who receives an email. Section 24-80-101 excludes electronic mail messages from its definition of 
"records," unless the recipient has decided to save them because they relate to a government activity 
"or because of the value of the official governmental data contained therein." 15 A general guidelines 
memo published by the State Archives says electronic messages can take many forms, "[ijncluding 
'yellow stickys', memos, and transmittal letters," and may or may not be considered public records 
based on their content. 16 Thus, according to the State Archives, it is the content of a communication, not 
its form, that determines whether a piece of correspondence is a public record and how long it must be 


11 Colo. Rev. Stat. § 24-80-101(1) (2019). 

12 Colo. Rev. Stat. § 24-80-101(2) (2019). 

13 Colo. Rev. Stat. § 24-80-102.7(2)(a) (2019). 

14 Bill Summary, H.R. 16-1368, 70th Gen. Assemb., 2d Reg. Sess. (Colo. 2016) (preamended). 

15 Colo. Rev. Stat. § 24-80-101(2)(f) (2019) ("[T]he following are excluded from the definition of records: ... 
Electronic mail messages, regardless of whether such messages are produced or stored using state-owned 
equipment or software, unless the recipient has previously segregated and stored such messages as evidence of 
the organization, functions, policies, decisions, procedures, operations, or other activities of the government or 
because of the value of the official governmental data contained therein."). 

16 Colorado State Archives, Records Management Services: Electronic Messaging Guidelines (E-Mail), 
https://www.colorado.gov/pacific/sites/default/files/ELECTRONIC-MESSAGING-GUIDELINES-E-MAIL_0.pdf. 
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kept. 17 The guidelines memo also says that "[b]oth the author and the recipient must use their 
judgement [sic] as to the nature of the material and take appropriate steps to treat the Electronic 
Messages just as they would any other form of information," adding that employees should reference 
the "Public Records Law" (Sections 24-80-101 to 24-80-111) for guidance. 18 

3. State Archives' model schedules 

The State Archives promulgates model records retention schedules. The model for municipalities 
establishes a classification system for emails that relies on whether they have long-term value (retain 
permanently), routine value (retain two years), or transitory value (retain until read). 19 The model 
schedule for state agencies sets forth a similar system for all correspondence. 20 However, in the recent 
past, state employees' emails were automatically deleted after 30 days unless intentionally set aside for 
retention. 21 The state has now upgraded from a basic Google for Governments subscription to G Suite 
Enterprise, which can keep emails longer than 30 days. 22 But emails that are double-deleted are still not 
recoverable. 23 The Colorado General Assembly's email policy also includes a similar classification system, 
but adds: 

"[T]he best practice is to delete all e-mail within thirty days after you have received or 
sent it, unless there is an overriding reason to retain it for longer than thirty days. (See 
section 24-80-101(l)(f), C.R.S. 24 ). Any email that you retain may become the subject of 
an open records request." 25 

The policy says "transient" email "that is personal in nature, of fleeting or no value, or otherwise not 
created or received in the course of state business may be (and is encouraged to be) deleted 


17 Id.; Telephone Interview with Paul Levit, Colorado State Archives (Feb. 21, 2019). This is also the approach of 
most state records-management statutes. See Zansberg, supra note 1, at 17 (State public records laws "dictate 
that the length of time for keeping records must be determined by the content of the record, not its format, 
medium, or title."). 

18 Electronic Messaging Guidelines (E-Mail), supra note 16. 

19 Colorado State Archives, Colorado Municipal Records Retention Schedule: Schedule No. 40 General Administrative 
Records 40.100, https://www.colorado.gov/pacific/sites/default/files/Sched40-MunSuppl2_l.pdf. 

20 Colorado State Archives, Records Management Manual State Government Agencies: Schedule No. 1 Administrative 
Records 1-5D, https://drive.google.eom/file/d/OB-21ETcKVa4LZIotaVpYSVpZY3dhNzB6NDBOUOVDZFhrOWRF/view. 

21 Todd Shepherd, Shepherd: Flint Water Crisis a Lesson for Colorado Government Email Retention, Colorado 
Freedom of Information Coalition, Feb. 15, 2016, https://coloradofoic.org/shepherd-flint-water-crisis-a-lesson-for- 
colorado-government-email-retention/. 

22 E-mail from Jill Elggren, Internal Communications Manager, Governor's Office of Information Technology, to 
author (April 4, 2019, 19:21 MST) (on file with author). 

23 Id. 

24 The author believes this is a typo or outdated citation and that they actually mean 24-80-101(2)(f). 

25 Legislative Policies Related to Public Records and E-Mail 11 (2013), 
https://leg.colorado.gov/sites/default/files/corapolicyga.pdf. 
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immediately after reading, but in no event more than thirty days after receipt." 26 "Administrative E- 
mail," or emails that serve some purpose but do not have permanent retention value, are 
recommended to be deleted after they are no longer needed and generally before 30 days. 27 For emails 
that are "neither transient nor permanent" but have "more significant administrative, legal, or fiscal 
value than an administrative e-mail," the policy states: "Although there is no statutory requirement that 
any e-mail be retained as a public record, you should retain this e-mail until you have responded to it or 
until is no longer useful to you before you delete it." 28 Though it mentions permanent retention, the 
legislature's policy does not describe what emails should be retained permanently. 29 In reality, it has 
been reported that legislators and their staff typically delete many of their emails soon after they have 
read them. 30 

While the above-mentioned model retention schedules all follow a similar pattern for email, the 
manual for school districts is more specific. 31 It says to retain "routine correspondence" for two years. 32 
Legal, fiscal, or policy correspondence should be retained permanently. 33 However, in the next 
paragraph, it suggests following the school district's email policy regarding electronic mail. 34 The 
Colorado Association of School Boards has promulgated a model policy stating that district emails may 
be monitored to ensure that all public records are retained, archived or destroyed in compliance with 
state law. 35 

Karen Goldman, a former municipal and state legislative clerk who is now leading a clerk adviser 
program at the Colorado Municipal League, noted that some municipalities, especially large ones, have 


26 Id. at 11-12. 

27 Id. at 12. 

28 Id. (emphasis added). 

29 Id. at 11-12. 

30 Tessa Cheek, Colorado's Analog Records Laws Lag Behind Digital Practice, Colorado Independent, Jan. 24, 2014, 
https://www.coloradoindependent.com/2014/01/24/colorados-analog-records-laws-lag-behind-digital-practice/. 

31 One Colorado court recently held that school districts are considered political subdivisions, rather than state 
agencies, and that therefore § 24-80-102.7 does not apply to them. Zbylski v. Douglas Cty. School Dist., 154 
F.Supp.3d 1146, 1169 (D. Colo. 2015). However, in 2016, the legislature added a definition of "governmental 
agency" to the Public Records Law: "'Governmental agency' means any state agency and any office, department, 
division, board, bureau, commission, institution, or agency of any county, city, city and county, special district or 
other district in the state, or any legal subdivision thereof." H.R. 16-1368, 70th Gen. Assemb., 2d Reg. Sess. (Colo. 
2016). 

32 Colorado State Archives, Records Management Manual School Districts: Schedule 2 General Administrative Records 
H 7, https://www.colorado.gov/pacific/sites/default/files/SchoolsRMManual.pdf. 

33 Id. at H 8. 

34 Id. at H 9. 

35 https://z2.ctspublish.com/casb/DocViewer.jsp?docid=124&z2collection=core 
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adopted separate email policies that differ from the guidelines somewhat. 36 She said she would not 
advise any agency to delete emails on a daily basis, and whatever policy municipalities adopt, it's 
important that every department follow the same procedures. 37 

4. State Archives' role 

Colorado State Archives helps public entities in Colorado develop their records policies. 38 State 
agencies are not required to store their records with the State Archives, but it is the "official repository" 
of all state records, 39 meaning agencies can store permanent records there after they are no longer in 
use. 40 State agency records constitute the majority of the archives collection, but all levels of 
government are represented, with county records being the next largest group. 41 

Paul Levit, a State Archives records manager, said he "despises" the language in Section 24-80-101 
that excludes electronic mail messages from the definition of records. 42 In "record management world," 
he noted, content matters more than format. Email is only a format, so he doesn't see why the statute 
treats it differently. 43 

The State Archives generally does not accept emails for permanent storage because it does not have 
a way to store electronic records in perpetuity. 44 The office recently made an exception when it 
accepted electronic records from Gov. John Hickenlooper's administration. 45 Focusing on archiving the 
correspondence of high-level officials, Mr. Levit said, is generally how archivists treat emails, a practice 
that is consistent with the National Archives' Capstone approach, discussed later in this paper. 46 

Electronic space is not infinite. Electronic records take up space, and there are costs associated with 
creating more. 47 To work collaboratively with all agencies and carefully monitor their recordkeeping, the 
State Archives would need more staff, Mr. Levit said. 48 Currently, the office has eight full-time 


36 Telephone Interview with Karen Goldman, Colorado Municipal Clerk Advisor Program consultant, Colorado 
Municipal League (Feb. 6, 2019). 

37 Id. 

38 Telephone Interview with Paul Levit, Colorado State Archives (Feb. 21, 2019). 

39 Id. 

40 E-mail from Paul Levit, Colorado State Archives to author (Sept. 16, 2019, 09:23 MST) (on file with author). 

41 Id. 

42 Telephone Interview with Paul Levit, Colorado State Archives (Feb. 21, 2019). 

43 Id. 

44 Id. 

45 Id. 

46 Id. See more discussion of Capstone Approach to email management, infra Section II.A.2. 

47 Telephone Interview with Paul Levit, Colorado State Archives (Feb. 21, 2019). 

48 /c/. 
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employees and sometimes an intern or a temporary contractor. 49 Mr. Levit and one other part-time 
employee work in records management. 50 

B. Colorado Open Records Act (C.R.S. § 24-72-201 et seq.) 

1. Current statutory language 

Although the emails and text messages of public officials are considered public records for purposes 
of the Colorado Open Records Act (subject to certain statutory exceptions), the law is silent as to how 
long and through what method electronic (or paper) records are to be retained. Regarding the safe 
keeping of public records, CORA states: 

(1)... (b) Where public records are kept only in miniaturized or digital form, whether on 
magnetic or optical disks, tapes, microfilm, microfiche, or otherwise, the official 
custodian shall: 

(I) Adopt a policy regarding the retention, archiving, and destruction of such records ... 51 

The statute requires that government entities adopt a policy, but it doesn't specify the 
content of such a policy. Thus, a policy saying "all emails should [or must] be deleted upon 
receipt" would not violate CORA. One Colorado judge has interpreted CORA as not requiring 
retention other than after a records request is made. 52 It is generally understood that, as for 
requests made under the federal FOIA, records that will potentially be disclosed in accordance 
with a CORA request must be preserved once the request has been received. 53 

2. Electronic correspondence under CORA 

CORA includes a specific provision about emails, but it generally concerns policies about the 

monitoring of public employee email systems: 

(1) On or before July 1,1997, the state or any agency, institution, or political subdivision 
thereof that operates or maintains an electronic mail communications system shall 


49 Id. 

50 Id. 

51 Colo. Rev. Stat. § 24-72-203 (2019). 

52 Alicia Caldwell, Caldwell: In Poudre School District, A Lesson on How Not to Handle Public Records, The Denver 
Post, March 28, 2014, https://www.denverpost.com/2014/03/28/caldwell-in-poudre-school-district-a-lesson-on- 
how-not-to-handle-public-records/. 

53 This is because, once an open-records request is made, they are subject to pending litigation. See spoliation 
discussion infra, Section I.E. See also FOIA Update: Recordkeeping Procedures Examined, The United States 
Department of Justice (Jan. 1, 1981), https://www.justice.gov/oip/blog/foia-update-recordkeeping-procedures- 
examined ("Agencies should be aware that once a Freedom of Information Act request has been received, the 
requested records assume a special status and ordinarily must be retained until the requester's access rights are 
determined."). 
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adopt a written policy on any monitoring of electronic mail communications and the 
circumstances under which it will be conducted. 

(2) The policy shall include a statement that correspondence of the employee in the 
form of electronic mail may be a public record under the public records law and may 
be subject to public inspection under section 24-72-203. 54 

Section 24-72-204.5 was adopted with the intention of clarifying what was required of public 
employees regarding emails that are public records, as evidenced by its accompanying legislative 
declaration: 55 

"[individual officials are not equipped to act as official custodians of such 
communications and to determine whether or not the communications might be public 
records. For these reasons, this act is intended to balance the privacy interests and 
practical limitations of public officials and employees with the public policy interests in 
access to government information." 56 

But while these 1996 additions made it clear that email and other electronic records are public 
records for purposes of CORA, they did not specify how long such records should be retained. 57 

Text messages "made, maintained or kept for use" in conducting public business are also public 
records for purposes of CORA. 58 And the definition of "public records" in the law includes the 
correspondence of elected officials, with certain exceptions. 

C. Uniform Records Retention Act 

Colorado's Uniform Records Retention Act states: 

"Any record required to be created or kept by any state or local law or regulation may 
be destroyed after three years from the date of creation, unless such law or regulation 
establishes a specified records retention period or a specific procedure to be followed 
prior to destruction." 59 

The law applies to "all records prepared by private individuals, partnerships, corporations, or any 
other association, whether carried on for profit or not, and to any government entity operating under 


54 Colo. Rev. Stat. § 24-72-204.5 (2019). 

55 S. 96-212, 60th Gen. Assemb., 2d Reg. Sess. (Colo. 1996). 
https://leg.colorado.gov/sites/default/files/images/olls/1996a_sl_271.pdf 

56 Id. 

57 Colorado is not alone in this problem. See, e.g., Poynter., supra note 3 ("at the state level... open records laws 
rarely specify email retention requirements, and other laws or regulations often give too much discretion to 
individual employees"); and more discussion of other state laws, infra Section III.B. 

58 Denver Pub. Co. v. Bd. Of Cnty. Comm'rs of Cnty. Of Arapahoe, 121 P.3d 190, 192 n.l (Colo. 2005) (treating text 
messages the same as forms of "electronic mail" for purposes of CORA). 

59 Colo. Rev. Stat. § 6-17-104 (2019). 
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the laws of this state." 60 Its stated purpose is to "minimize the paperwork burden associated with the 
retention of business records for individuals, small businesses, state and local agencies, corporations, 
and other persons." 61 However, it is cited in the Colorado Municipal Records Retention Schedule as the 
default rule for records that otherwise do not have an applicable retention period. 62 Ms. Goldman said 
she tells clerks that as well. 63 However, Mr. Levit said he typically does not rely on this statute in crafting 
retention policies. 64 

D. Rules of Evidence 

There is also a duty to preserve records during pre-trial discovery, although these statutes merely 
state who must retain certain records and do not speak to the duration of retention. The Federal Rules 
of Civil Procedure "seek to further the interests of justice by minimizing surprise at trial and ensuring 
wide-ranging discovery of information." 65 "So as to protect each party's ability to participate in the 
expansive discovery permitted by Rule 26(b)(1), putative litigants have a duty to preserve documents 
that may be relevant to pending or imminent litigation." 66 "Spoliation" results from "the destruction or 
significant alteration of evidence, or the failure to preserve property for another's use as evidence in 
pending or reasonably foreseeable litigation." 67 

When litigation is under way or pending, this evidentiary duty to preserve overrides any pre-existing 
practice or routine retention schedule for records related to the litigation. 68 Several records retention 
schedules promulgated by State Archives explicitly recognize this duty with respect to public records. 69 
But there is a distinction between what must be disclosed in discovery and what records are open to 


60 Colo. Rev. Stat. § 6-17-106 (2019). 

61 Colo. Rev. Stat. § 6-17-102 (2019). 

62 Colorado State Archives, Colorado Municipal Records Retention Schedule: HowTo Use The Colorado Municipal 
Records Retention Schedule, https://www.colorado.gov/pacific/sites/default/files/HowToUseMunSuppl2_l.pdf. 

63 Telephone Interview with Karen Goldman, Colorado Municipal Clerk Advisor Program consultant, Colorado 
Municipal League (Feb. 6, 2019). 

64 E-mail from Paul Levit, Colorado State Archives to author (Sept. 16, 2019, 09:23 MST) (on file with author). 

65 Zbylski v. Douglas Cty. School District, 154 F.Supp.3d 1146, 1158 (D. Colo. 2015) (citing Cache La Poudre Feeds, 
LLC v. Land O'Lakes, Inc., 244 F.R.D. 614, 619 (D.Colo. 2007)). 

66 Id. 

67 Id. (quoting Oto Software, Inc. v. Highwall Technologies, LLC, No. 08-cv-01897-PAB-CBS, 2010 WL 3842434, at 
*7 (D.Colo. August 7, 2010)). 

68 See, e.g., Colorado State Archives, Colorado Municipal Records Retention Schedule: Schedule No. 40 General 
Administrative Records https://www.colorado.gov/pacific/sites/default/files/Sched40-MunSuppl2_l.pdf ("No 
record may be destroyed under this Retention Schedule if it is pertinent to any current, pending or anticipated 
investigation, audit or legal proceeding."). 

69 Id. 
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public access. 70 That same distinction can be drawn between the standards for preservation in each 


context. 


III. APPROACHES IN FEDERAL AGENCIES AND OTHER STATES 
A. Federal records retention 
1. Statutes 

The federal Freedom of Information Act has no specific retention provision and courts have 
interpreted FOIA as not creating a duty to retain public records. 71 However, some documents that are 
classified as "non-record" for purposes of records management laws could still be agency records for 
purposes of FOIA. 72 A records disposal regulation, while a factor, is not dispositive as to whether 
something is an agency record for purposes of FOIA. 73 "[A]n agency should not be able to alter its 
disposal regulations to avoid the requirements of FOIA." 74 

In general, the Federal Records Act governs the management of federal agency records. 75 The 
National Archives interprets this law as requiring agencies to manage their email records in accordance 
with the act and with the corresponding regulation (36 CFR Chapter XII Sub-chapter B). 76 A memo issued 
by the National Archives in 2012 directed all federal agencies to "manage both permanent and 
temporary email records in an accessible electronic format" by 2016. 77 

The Federal Records Act also requires employees using non-official or personal email accounts for 
public business to either copy their official email address or forward a copy of any records made to their 
official account within 20 days of the correspondence. 78 


70 See, e.g., People in the Interest of A.A.T., 759 P.2d 853, 855 (Colo. App. 1988) ("[T]he claim of entitlement to 
access to public records under the Act presents issues distinct from the issue of the discoverability of possible 
evidence for use in litigation."). 

71 Bureau of National Affairs v. Dep't of Justice, 742 F.2d 1484, 1493 (D.C. Cir. 1984). 

72 Id. 

73 Id. 

74 Id. 

75 44 U.S.C. § 3101 et seq. See also Email Management, National Archives, https://www.archives.gov/records- 
mgmt/email-mgmt (last visited May 9, 2019) (interpreting the Act as requiring that agencies manage email records 
in accordance with the Act). 

76 Email Management, National Archives, supra note 75. 

77 Managing Government Records Directive, M-12-18 (Nat'l Archives and Records Admin. Aug. 24, 2012), 
https://www.archives.gov/files/records-mgmt/m-12-18.pdf. 

78 Criteria for Managing Email Records in Compliance with the Managing Government Records Directive 4 (Nat'l 
Archives and Records Admin. April 6, 2016), https://www.archives.gov/files/records-mgmt/email- 
management/2016-email-mgmt-success-criteria.pdf. 
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2. Capstone Approach 

The Capstone approach, created by the National Archives, is one approved method of managing 
email records in accordance with the statutory requirements. 79 Under this approach, the decision to 
retain emails is determined by an account user's role or position in an agency rather than the content of 
correspondence. 80 Emails managed under the Capstone approach adhere to the following retention 
schedule: 81 

• Permanent: The emails of "Capstone officials," such as agency heads; their principal assistants 
and deputies; principal managers such as COOs, chief information officers, etc.; program 
directors; regional directors; other positions that provide advice or oversight, such as general 
counsel. 

• Temporary, delete after seven years: All other positions except those in the next group. 
"[L]onger retention is authorized if required for business use." 

• Temporary, delete after three years: Support and/or administrative positions. 

The emails of Capstone officials are transferred to the National Archives and Records Administration 
15 to 25 years after the agency no longer needs them, or after a declassification review, whichever is 
longer. 82 However, agencies are expected to "cull" Capstone emails before transferring them, 
eliminating "nonrecord, personal, or transitory messages and attachments," such as "spam, email blasts 
..., and personal materials." 83 

As of April 2019, 193 of 296 federal agencies reporting had adopted the Capstone approach for 
email management. 84 The other 103 agencies had adopted it with some variations, received approval 
for an agency-specific schedule, or had not reported adopting a retention schedule. 85 Capstone is 
gaining popularity with archivists at the state and local level too. For example, a software program 
created by the Oregon State Archives integrates the Capstone approach into the way it organizes 


79 Email Management, National Archives, supra note 75 ("The issuance of NARA Bulletin 2013-2 established "the 
Capstone Approach" as an alternative means of managing email, while the transmittal of GRS 6.1 provides 
disposition authority for the approach. Both issuances provide one way in which Federal agencies can meet the 
requirements of Goal 1.2 of M-12-18"). 

80 National Archives and Records Administration, White Paper on the Capstone Approach and Capstone GRS, 7 (April 
2015), https://www.archives.gov/files/records-mgmt/email-management/final-capstone-white-paper.pdf. 

81 National Archives, Transmittal No. 26, General Records Schedule 6.1 (September 2016), 
https://www.archives.gov/files/records-mgmt/grs/grs06-l.pdf. 

82 Id. 

83 Id. 

84 National Archives, Email Disposition Spreadsheet, available at https://www.archives.gov/records-mgmt/email- 
management/agency-email-disp.html. 

85 Id. 
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emails. 86 North Carolina is developing its own Capstone-style program for email retention. 87 Reinvent 
Albany, an organization that advocates for government transparency in New York, has called on Gov. 
Andrew Cuomo to adopt Capstone by executive order. 88 And in Colorado, the State Archives used this 
approach to determine which emails to retain from Gov. Hickenlooper's administration. 89 

B. State Approaches 

While state open records acts rarely include statutory retention requirements, 90 most states at least 
have a records management law addressing the retention, disposal, and general maintenance of public 
records. 91 However, those statutes vary as to how clearly they require agency adherence, and some, like 
Colorado's, give public employees a wide degree of discretion in managing their own emails. 92 

What follows are examples of different ways some states have improved their records retention 
practices. 

1. Electronic tools for more efficient records management 

Oregon 

Oregon has invested in a software program that automatically stores records in accordance with 
their designated retention schedules. Said to be "the first of its kind in the nation," Oregon Records 
Management Solutions (ORMS) was developed in partnership with Chaves Consulting, a private firm, 
and is available to all public agencies in the state. 93 


86 See more discussion of Oregon's electronic record management system infra Section III.B.l.a. 

87 Camille Tyndall Watson, Case Study lfs^Working with Stakeholders to Create/Influence PoHcy:[s}_pJNorth Carolina 
TOMES Project, CoSA-NHPRC Symposium 2 (Sept. 15, 2017), 

https://www.archives.gov/files/nhprc/projects/electronic-records/pdf/case-study-l-working-with-stakeholders- 

nc-tyndall-watson.pdf. 

88 John Kaehny et al., Groups Applaud End of Automatic Deletion of Emails, Reinvent Albany (May 22, 2015), 
https://reinventalbany.org/2015/05/groups-applaud-end-of-automatic-deletion-of-emails/. 

89 See supra Section II.A.4. 

90 Poynter., supra note 3. 

91 Reporters Committee for Freedom of the Press, supra note 2. 

92 See Poynter., supra note 3 ("The relationship between email management and freedom of information can be 
even more complicated at the state level, where open records laws rarely specify email retention requirements, 
and other laws or regulations often give too much discretion to individual employees."). See discussion of 
Colorado law, supra Section II.A.2. 

93 Oregon Records Management Solution (ORMS), Oregon Secretary of State, 
https://sos.oregon.gov/archives/Pages/orms.aspx (last visited May 14, 2019). 
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Agencies pay to participate ($370.20 per month), 94 and state archives employees help them set up 
ORMS in their organizations. 95 They build retention schedules into the program 96 so that, as agencies 
save documents of the same type, the records automatically get retained the proper amount of time. 97 
At the end of each year, ORMS sends agencies a list of what records will be destroyed, and they can still 
decide to keep some records longer than the required retention period if they still need them. 98 ORMS 
also allows for records to be put on litigation holds. 99 Regarding emails, ORMS includes a form of 
Capstone that assigns a retention period based on the sender's role in the organization. 100 More than 50 
entities participate, including state and local government agencies, special districts, and school 
districts. 101 

Along with the technology, Oregon also "engagefs] stakeholders early and continuously." 102 State 
archivists and ORMS technicians are available to provide support to agencies using the system. 103 The 
archivists tout ORMS as a cost-effective records management tool that also helps agencies free up 
expensive storage space by only keeping what is required. 104 

North Carolina 

North Carolina began working on a Capstone-style, "role-based" system of email management for its 
government agencies in 2015. 105 Called "Transferring Online Mail with Embedded Semantics," or 
TOMES, the project's primary goal "is to provide solutions to state government agencies that are 
feasible to implement." 106 The goal of TOMES is to develop a method by which Capstone emails are 
automatically transferred to the state archives 107 while protecting confidential and other types of non- 


94 ORMS: Subscription Pricing, Oregon Secretary of State, 

https://sos.oregon.gov/archives/Documents/recordsmgmt/orms-pricing-information.pdf (last visited May 14, 
2019). 

95 Oregon Records Management Solution (ORMS), supra note 93. 

96 id. 

97 Telephone Interview with Chris Fuller, Records Management Analyst, ORMS (April 4, 2019). 

98 Id. 

99 Oregon Records Management Solution (ORMS), supra note 93. 

100 Telephone Interview with Chris Fuller, Records Management Analyst, ORMS (April 4, 2019). 

101 ORMS Overview, Oregon Secretary of State, https://sos.oregon.gov/archives/Documents/recordsmgmt/orms- 
overview-presentation.pdf (last visited May 14, 2019). 

102 Michelle Gallinger et al., Council of State Archivists & Nat'lAss'n of State Chief Info. Officers, State Archiving In 
The Digital Era: A Playbook ForThe Preservation Of Electronic Records 4 (October 2018). 

103 Id. 


104 

105 

106 
107 


ORMS Overview, supra note 101; Fuller, supra note 97. 
Watson, supra note 87. 

Id. 

Id. 
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record information. Accomplishing this goal has proved challenging, 108 and as of May 2019, the tools 
were still being developed. 109 But the Capstone approach has been integrated into North Carolina's 
retention schedules. 110 

In addition to some technical difficulties, the project met some opposition from agencies, 
particularly those concerned about security or confidentiality. 111 The state archives office addressed this 
problem by meeting with agencies and explaining how the project worked, what was expected of them, 
and why the state was doing it. 112 In the future, TOMES wants to develop (1) a connection between the 
state's human resources platform and the email archives and (2) a workflow for the transfer of email 
accounts so that records are not lost when an employee leaves an agency. 113 

Importantly, TOMES was created using a three-year grant from the National Heritage Publications 
and Records Commission in 2015. 114 Some electronic records preservation began in North Carolina 
under Gov. Jim Hunt in 2001, and Gov. Pat McCrory signed an executive order in 2013 requiring that all 
state emails be retained for five years, 115 reducing the previously existing 10-year retention period in the 
hopes of "achiev[ingj significant cost savings." 116 So while buy-in from agencies was a challenge for the 
archivists, they had the support of a federal grant and the impetus of an executive order to encourage 
progress. 

2. Addressing through statute 

California 

A bill working its way through committees in the California legislature would amend the Public 
Records Act to require that emails and other electronic transmissions be retained for two years by all 


108 Id. at 3-5. 

109 E-mail from Jamie Patrick Burns, Digital Archivist, State Archives of North Carolina, to author (May 3, 2019, 
12:04 MST) (on file with author). 

110 Id. 

111 Watson, supra note 87, at 3. 

112 Id. at 4. 

113 Id. at 5. 

114 Id. at 2. 

115 Id. 

116 State Archives of North Carolina, Executive Order No. 12: Amending the State E-Mail Retention and Archiving 
Policy, The G.S. 132 Files (blog) (June 5, 2013), https://ncrecords.wordpress.com/2013/06/05/executive-order-no- 
12-amending-the-state-e-mail-retention-and-archiving-policy/ (quoting N.C. Exec. Order No. 2013-12 (May 21, 
2013)). This executive order also mandated that state employees either use a statewide email system that 
includes archiving capabilities or back up their emails once a day. Id. at cl. 2. 
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public agencies in the state. 117 An existing statute already requires municipalities to maintain all their 
records for two years, 118 but this legislation would apply to all public entities, including state agencies, 
special districts, and schools. 119 

Missouri 

Missouri has adopted legislation specifically targeting the retention of electronic messages. 120 The 
statute requires that "[a]ny member of a public governmental body who transmits any message relating 
to public business by electronic means ... concurrently transmit that message to either the member's 
public office computer or the custodian of records in the same format." 121 However, the law is limited, 
applying only to communications "sent to two or more members ... so that, when counting the sender, a 
majority of the body's members are copied." 

Journalists reportedly struggled to obtain text messages related to the police shooting death of 
Michael Brown in Ferguson, Missouri, 122 and Missouri Gov. Eric Greitens faced litigation in 2018 over his 
use of Confide, a messaging app that automatically deletes communications after they have been 
viewed by the recipient. 123 The new statute doesn't address how long text messages must be retained. 

Montana 

In 2015, Montana overhauled its public records act, which lumps together right-to-access and 
records management provisions. 124 State agency records are not to be disposed of without approval by a 
retention and disposition subcommittee, unless it's done in accordance with an already-approved 
retention schedule. 125 The law also mandates that a departing public employee transfer her records to 
her successor; 126 that the state bring its information-technology systems up to par in order to 


117 Telephone Interview with Terry Francke, General Counsel, Cal Aware (May 8, 2019); 
htt ps ://legi nfo. legislature. ca.gov/faces/billTextClient. xhtml ?bill_id=201920200AB1184 

118 Cal. Gov't Code § 34090(d) (West 2019). 

119 Telephone Interview with Terry Francke, General Counsel, Cal Aware (May 8, 2019). 

120 Mo. Rev. Stat § 610.025 (2019). 

121 Mo. Rev. Stat § § 610.025 (2019). 

122 Vera, supra note 7, at 31. 

123 Breland, supra note 10. 

124 See Mont. Code Ann. § 2-6-1001 et seq. (2019). 

125 Mont. Code Ann. § 2-6-1109(3)-(4) (2019). In general, public records in Montana "must be preserved, stored, 
transferred, destroyed, or disposed of and otherwise managed only in accordance with the provisions of" Chapter 
6. Mont. Code Ann. § 2-6-1013 (2019). 

126 Mont. Code Ann. § 2-6-1013 (2019). Other states with provisions addressing departing employees' records 
include Ohio (Ohio Rev. Code Ann. § 149.351(A) (West 2019)) and South Carolina (S.C. Code Ann. § 30-1-40 (2019)). 
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electronically capture, store and retrieve records; 127 and that agency records requiring permanent 
retention be maintained by the agency or transferred to the state records center. 128 

However, not all those requirements are being put into practice or enforced, and much is still left to 
the discretion of public employees to manage their own email and text accounts. 129 The emails of 
departing employees are said to be automatically deleted one month after they leave their agency. 130 
And, according to one local newspaper, the state archives does not have storage space to actually store 
government emails if they were to be transferred there. 131 As Mike Meloy, attorney for the Montana 
Freedom of Information Hotline, said: 

While the overall purpose of the law seems to be working, the biggest problem arises 
from the ability of individual state and local employees to self-delete emails ... 
particularly from their private email servers. So a good document preservation law is 
only as good as the enforcement mechanism. In Montana the only way to enforce a 
document request is to go to court... and that doesn't happen very often. 132 

3. Penalizing non-retention 

Florida is unique in that "the penalty for deleting records that should be retained is the same as the 
penalty for not producing a record [agencies] actually have." 133 While the penalty is "on the books," so 
to speak, University of Florida Professor Frank LoMonte is not sure how often public officials actually get 
penalized since there is so much room for discretion when determining whether a record must be 
retained, especially when it comes to emails. 134 


127 Mont. Code Ann. § 2-6-1102 (2019). 

128 Mont. Code Ann. § 2-6-1114 (2019). 

129 E-mail from Peter Michael Meloy, Attorney, Montana Freedom of Information Hotline Inc., to author (April 8, 
2019, 8:25 MST) (on file with author); see also Jayme Fraser, Montana Fails To Retain Decades Of Emails Despite 
Open Government Law, Missoulian, Jan. 2, 2017, https://missoulian.com/news/state-and-regional/govt-and- 
politics/montana-fails-to-retain-decades-of-emails-despite-open-government/article_c6bl6a66-4c62-5090-872c- 
98435614cc77.html. 

130 Fraser, supra note 129. 

131 Id. 

132 E-mail from Peter Michael Meloy, Attorney, Montana Freedom of Information Hotline Inc., to author (April 8, 
2019, 8:25 MST) (on file with author). 

133 E-mail from Frank LoMonte, Professor and Director, The Brechner Center for Freedom of Information, to author 
(April 1, 2019, 18:50 MST) (on file with author) (discussing Fla. Stat. § 119.10(l)(a) (2019) ("Any public officer who: 
(a) Violates any provision of this chapter commits a noncriminal infraction, punishable by fine not exceeding 
$500.")). 

134 E-mail from Frank LoMonte, Professor and Director, The Brechner Center for Freedom of Information, to author 
(April 3, 2019, 9:33 MST) (on file with author). 
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Ohio provides a civil cause of action for those who believe a record has been removed, destroyed, 


harmed or transferred in violation of Ohio Rev. Code § 149.351(A). 135 

4. Addressing in the courts 

Ohio courts have upheld a duty to retain emails and text messages. In 2008, the Supreme Court of 
Ohio held that "a public office violates R.C. 149.43(B) by deleting e-mails that it has a statutory 
obligation to maintain." 136 The office has a duty to recover emails that were inappropriately deleted if it 
is possible for them to be recovered by reasonable effort. 137 Cost is not a permissible barrier. 138 
However, "in cases in which public records, including e-mails, are properly disposed of in accordance 
with a duly adopted records-retention policy, there is no entitlement to those records under the Public 
Records Act." 139 

This year, the city of Cincinnati lost an argument that text messages were not public records because 
of their format. 140 The Ohio Court of Claims held that text messages concerning city business, even those 
on private devices, are public records, and that it is every public agency's duty to ensure those records 
are being retained. 141 Following the lawsuits, Cincinnati instructed its employees how to preserve text 
messages, including emailing screenshots to their government accounts and making sure their settings 
wouldn't automatically delete texts in the future. 142 

5. Citizen/government employee task forces 

The Council of State Archivists advocates for a collaborative approach to electronic records 
management, specifically involving a state's communications information officer (or equivalent), state 
archivists, other records management officials, the state attorney general and other government 
lawyers, and agency heads. 143 


135 Ohio Rev. Code Ann. § 149.351(B) (West 2019). 

136 State ex rel. Toledo Blade Co. v. Seneca Cty. Bd. of Commrs., 120 Ohio St.3d 372, 379 (Ohio 2008). 

137 Id. at 379, 383. 

138 Id. at 381. 

139 Id. at 378. 

140 Jack Greiner, Jack Out of the Box: Moving the Needle, Graydon, March 25, 2019, https://graydon.law/moving- 
the-needle-public-records/. 

141 Id. 

142 Id. 

143 Gallinger, supra note 102. 
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Florida launched an Electronic Records Workgroup in 2017 that sought to identify electronic records 
for preservation and come up with better practices. 144 Another interesting project in Florida was Project 
Sunburst, which gave the public digital access to the governor's email as well as that of his executive 
staff. 145 But the governor and his staff began using private email accounts to avoid publicizing their 
correspondence. 146 

The "Ohio Sunshine Laws" handbook, published by the state attorney general, provides several 
pages of material on records retention, including the law and "practical pointers." 147 The Ohio State 
Archives has also published an email management tool that describes in a visual manner how to apply 
the state's email policy, which looks a lot like Colorado's in that it categorizes emails based on their 
content. 148 


IV. RECOMMENDATIONS 

A. Enact statutory records requirements and/or enforce existing ones 

As discussed above, other states have adopted records retention requirements by legislation or by 
executive order. Colorado should adopt a mandatory retention requirement for public agencies as well. 
The state should clarify (1) what records are to be retained; (2) for how long; (3) that the requirement is 
mandatory for all agencies; and (4) that the requirement applies during the transfer of a departing 
employee's records to her successor. Adopting penalties or some other kind of enforcement mechanism 
should also be considered. 

Since Colorado already has retention requirements located outside of CORA, another option would 
be to follow California's lead and simply adopt legislation or an executive order clarifying that all 
agencies must create a policy in accordance with the public records law and follow it. If agencies were 
statutorily required to abide by the retention schedules established by the State Archives, and if those 
schedules were enforced, that would be a vast improvement. 


144 A Dedicated Workgroup Takes on the Challenge of Archival E-Records Identification, Description, and 
Preservation at the State Archives of Florida, Council of State Archivists, 

https://www.statearchivists.org/connect/blog/2019/01/dedicated-workgroup-takes-challenge-archival-e-records- 
identification-description-and-preservation-state-archives-florida/(last visited May 14, 2019). 

145 See Poynter., supra note 3. 

146 Id.; see also Zansberg, supra note 1, at 12. 

147 Dave Yost, Ohio Sunshine Laws: An Open Government Resource Manual 61-65 (2019). 

148 Ohio History Connection, State Archives of Ohio: Email Management Decision Tree, Ohio History Connection, 
https://www.ohiohistory.org/OHC/media/OHC-Media/Learn/Archives-Library%20Documents/emailtree_final.pdf 
(last visited May 14, 2019). 
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However, the model schedules could still be improved by (1) addressing when an employee leaves a 
department; (2) addressing forms of correspondence other than email, such as text messages and those 
sent through messaging apps like Snapchat, Confide, or WhatsApp 149 ; and (3) integrating the federal 
Capstone approach for electronic correspondence. 

Public officials should also be discouraged from using private email accounts or private devices to 
conduct public business. While some use of private devices for scheduling or other transitory uses is 
hard to avoid, the retention of public records on these devices poses problems of transparency for even 
the most compliant individuals. The difficulty in obtaining such records or even confirming their 
existence makes it far too difficult to enforce. 

B. Adopt Capstone for email management 

As described above, the Capstone approach appears to be the gold standard for email management 
best practices. It achieves the goals of retaining emails that are potentially of greatest public importance 
while allowing agencies to free up space held by other correspondence. 

However, it will require more than just the suggestion or the adoption of policy promulgating the 
Capstone approach for public employees to actually use it. As has been demonstrated in North Carolina, 
developing the electronic tools to implement it and getting "buy-in" from agencies will be challenges, 
which leads to the next two recommendations. This is where an enforcement mechanism could be 
helpful. 

C. Consider purchasing software for electronic records management 

Oregon has a system up and running that was created with the help of a private partner. Colorado 
should consider a similar public-private partnership to create the best program and avoid some of the 
technological roadblocks faced by the North Carolina State Archives. While there will be some cost, 
some significant cost savings are anticipated in in the long run. Digital storage is generally cheaper than 
physical space, but it does still come with a cost, and so governments do "have a legitimate need to not 
'keep' everything in perpetuity." 150 Using an electronic tool that automates the retention and disposal 
process would make it easier for Colorado agencies to retain exactly what they're supposed to retain 
and nothing more. It could also alleviate much staff time and burden on the positions that function as 
records custodians in each agency. 

149 In May 2019, the U.S. Court of Appeals for the D.C. Circuit ruled that encrypted text messages sent via Signal 
(which automatically deletes them upon being opened) are not "agency records" under the Presidential Records 
Act. 

150 Zansberg, supra note 1, at 17. 
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D. Buy-in 

Significant "buy-in" from agencies is needed to get such a program off the ground. This will require a 
considerable amount of internal communications. That, as well as the future operations of a software 
program, could require additional staffing at the State Archives. 

Creating task forces like the ones seen in Florida and recommended by the Council of State 
Archivists also would help. If representatives from state agencies and local governments participate, 
state archivists could address their concerns while advocating for the program. 
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